On this page
- PCI validation and cost-driver estimator
- How much does PCI compliance cost?
- How much does PCI DSS certification cost?
- How much does a QSA audit cost?
- What drives the cost of PCI DSS compliance?
- What does non-compliance cost after a breach?
- How can you reduce the cost of PCI compliance?
- Why Sovereign Secure?
How much does PCI compliance cost?
There is no fixed PCI compliance cost, because the standard does not set one. The PCI Security Standards Council (PCI SSC) does not charge merchants to comply, and PCI DSS v4.0.1 and every SAQ are free from the PCI SSC document library. What you pay for is the work: validating each year, the scans and tests your route requires, and fixing whatever is missing.
Published UK price guidance we reviewed in September 2026 ranged from around £500 at the low end to £20,000 to £75,000 or more at the top end. Two businesses with the same turnover can sit at opposite ends, because one takes payments through a hosted payment page and the other stores card numbers.
What you are paying for, and how often:
| Cost item | Who needs it | How often | What sets the price |
|---|---|---|---|
| Completing an SAQ | Level 2 to 4 merchants; Level 2 service providers (SAQ D only) | Every year | Staff time and the SAQ type: SAQ A is short, SAQ D covers every applicable requirement |
| QSA review or signature on an SAQ | When your acquirer or a customer asks, and often at merchant Level 2 | Every year | Number of channels and the evidence to review |
| Report on Compliance (QSA audit) | Level 1 merchants and service providers, or anyone whose contracts require it | Every year | Assessor days: scope, locations, sampling, remote or on-site work |
| Gap analysis or readiness review | First-time validators and anyone moving to a ROC | Usually once, then as needed | Scope and how much documentation already exists |
| ASV scans | Anyone whose SAQ or ROC includes Requirement 11.3.2 | Every quarter, plus rescans | Number of public IP addresses and domains |
| Penetration and segmentation testing | ROC and SAQ D; external testing for SAQ A-EP; anyone relying on segmentation | At least every 12 months and after significant change; segmentation every 6 months for service providers | Number of IP addresses, applications and network segments |
| Remediation and tooling | Anyone with gaps | Mostly one-off, then running costs | MFA, logging, file-integrity and payment-page script monitoring, policies and training |
| Acquirer PCI programme fee | Merchants whose acquirer charges for its compliance portal and support | As your merchant agreement sets out, often monthly or yearly | Set by your acquirer in your contract, whether or not you have validated |
| Non-compliance fees | Merchants who have not validated | Monthly, until your acquirer accepts your validation | Set by your acquirer |
Some acquirers also charge a PCI compliance fee for their portal and support, which is part of your contract; a monthly PCI non-compliance fee is different, and it stops only when your acquirer accepts a valid SAQ or AOC and any scans your SAQ requires.
How much does PCI DSS certification cost?
PCI certification cost is really the cost of your annual validation, because there is no PCI DSS certificate to buy. The PCI SSC does not certify merchants or service providers, so what people call PCI DSS certification is that validation, and its cost follows your validation route: a self-completed SAQ, an SAQ reviewed or signed by a QSA, or a Report on Compliance. The PCI SSC charges nothing for the standard or the SAQs; you pay for the work, any scans and tests your route requires, and fixing gaps.
| Validation route | Typically used by | What you pay for | Where it sits in published UK price guidance (September 2026) |
|---|---|---|---|
| Self-completed short SAQ (for example SAQ A, B-IP or P2PE) | Small merchants with outsourced or standalone payments | Staff time, ASV scans where the SAQ requires them, and any fixes | Near the bottom of the range, which starts at around £500 |
| SAQ D, or an SAQ reviewed or signed by a QSA | Merchants with more systems in scope, Level 2 service providers, and anyone whose acquirer or customers ask for QSA involvement | Staff time, QSA days for review or signature, scans, penetration testing where required, and remediation | In between: set by scope and how many gaps need fixing |
| Report on Compliance by a QSA | Level 1 merchants and service providers, and anyone whose contracts require a ROC | QSA assessor days, scans, penetration and segmentation testing, and remediation | Near the top, where a Level 1 ROC with remediation sits: £20,000 to £75,000 or more |
These are market figures from published UK price guidance we reviewed, not our prices. We quote a fixed price once your scope is confirmed.
How much does a QSA audit cost?
A QSA audit, formally a Report on Compliance, is priced on the assessor days your scope needs, not on your size or turnover. The PCI QSA tests every applicable PCI DSS v4.0.1 requirement, samples systems and locations, interviews staff and reviews evidence, then writes the ROC and the Attestation of Compliance (AOC) your acquirer or customers receive.
The days go up with the number of payment channels and sites, the systems in or connected to the cardholder data environment (CDE), any requirements met through the customised approach, and how much evidence is ready on day one. PCI Level 1 merchants and service providers need a ROC every year; others choose one when an acquirer or customer asks.
We do not publish a list price for assessments, because no two scopes are the same size. We send a fixed quote after a short scoping call, and the assessment itself is delivered through our PCI DSS audit and QSA assessment service. If you are not ready yet, a gap analysis from our PCI DSS consultancy team is usually cheaper than discovering the same gaps during the assessment.
What drives the cost of PCI DSS compliance?
Scope drives cost more than anything else. Every system that stores, processes or transmits card data, or can affect its security, has to be secured, evidenced and tested. The estimator above weighs these drivers for you.
| Driver | Keeps cost down | Pushes cost up |
|---|---|---|
| Validation route | SAQ A, SAQ B-IP or SAQ P2PE | SAQ D or a Report on Compliance |
| Payment channels | One channel, fully outsourced | Online, in person and phone, each with its own systems |
| Stored card data | No card numbers stored, or provider tokens only | Card numbers in databases, spreadsheets, email or call recordings |
| Network segmentation | Payment environment isolated and tested | A flat network, so everything is in scope |
| Locations | One site | Many sites with their own terminals and networks |
| Third parties | A few providers with current AOCs | Many providers with unclear responsibilities |
| Merchant or service provider | Merchant | Service provider, with extra requirements and six-monthly segmentation testing |
| First year or renewal | Renewal, with controls running all year | First validation, or a lapse that needs catching up |
Our guide to PCI compliance levels explains who needs a ROC. For testing budgets, published UK pricing guidance we reviewed in September 2026 put typical penetration tester day rates at about £1,000 to £1,500. See how Requirement 11.4 is scoped on our PCI DSS penetration testing page, and quarterly external scans on our PCI ASV scans page.
What does non-compliance cost after a breach?
Non-compliance becomes far more expensive after a card data breach: acquirers usually pass card brand fines, forensic investigation and card reissue costs on to the merchant, and can require Level 1 validation in future. Card data is personal data, so a breach can also be a UK GDPR matter for the Information Commission’s Office (ICO), where the maximum fine is £17.5 million or 4% of annual worldwide turnover, whichever is higher. Fines, penalties and what triggers them are covered in our guide to the PCI non-compliance fee.
How can you reduce the cost of PCI compliance?
Reduce scope first. Every system you take out of scope is one you do not have to secure, evidence and test.
- Use a hosted payment page or iframe from a PCI DSS compliant provider, so card data never touches your website. That usually means SAQ A rather than SAQ A-EP or SAQ D.
- Move terminals to a PCI-listed P2PE solution, which can reduce in-person scope to SAQ P2PE. Our guide to PCI P2PE explains how it works.
- Tokenise or delete stored card numbers, including old spreadsheets, email and call recordings.
- Take phone payments with DTMF masking or a compliant IVR, so agents never hear or see card numbers.
- Segment the payment environment from the rest of your network, and test the segmentation.
- Get the SAQ right before you start. The wrong SAQ can mean doing the work twice. Our free PCI compliance test suggests your likely SAQ and shows your gaps in about five minutes.
- Plan testing together. Time scans and tests around your assessment date so one round of evidence serves them all.
- Keep controls running all year. Renewals cost less when evidence is collected as you go.
Small merchants: see our guide to PCI compliance for small business.
Why Sovereign Secure?
- A PCI SSC-approved assessor. Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire) is a Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor and 3DS Assessor company. You can check us on the PCI SSC Qualified Security Assessor list.
- Part of the assessor community. We are a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
- Every route covered. SAQ support, gap analysis, ROC assessments, penetration testing, and ASV scans delivered through our PCI SSC Approved Scanning Vendor partner.
- Security we practise. We are ISO 27001 certified, with offices in the UK, Los Angeles, Singapore, Dubai and Dhaka. Clients include Accor, Fiserv, Ticketmaster, Cashplus and Kuwait Finance House.
See our full range of PCI DSS compliance services.
How do you get a fixed quote?
Run the estimator and choose Get a fixed quote: your answers are copied into the enquiry form below, so you only add your contact details. We aim to reply within one working day and send a fixed quote once your scope is confirmed, or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
